From: Roland Dreier Date: Mon, 3 Feb 2014 08:35:03 +0000 (-0800) Subject: target: Fix missing length check in spc_emulate_evpd_83() X-Git-Tag: v4.9.8~6793^2~22 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=6a16d7be932a9df1024836ccbb448de73afd3dd0;p=platform%2Fkernel%2Flinux-rpi3.git target: Fix missing length check in spc_emulate_evpd_83() Commit fbfe858fea2a ("target_core_spc: Include target device descriptor in VPD page 83") added a new length variable, but (due to a cut and paste mistake?) just checks scsi_name_len against 256 twice. Fix this to check scsi_target_len for overflow too. Signed-off-by: Roland Dreier Signed-off-by: Nicholas Bellinger --- diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c index 43c5ca98..3bebc71 100644 --- a/drivers/target/target_core_spc.c +++ b/drivers/target/target_core_spc.c @@ -440,8 +440,8 @@ check_scsi_name: padding = ((-scsi_target_len) & 3); if (padding) scsi_target_len += padding; - if (scsi_name_len > 256) - scsi_name_len = 256; + if (scsi_target_len > 256) + scsi_target_len = 256; buf[off-1] = scsi_target_len; off += scsi_target_len;